Comment 3 for bug 1657187

I had a look at how we generate the token to start with.

There is no reason for us not to be able to display the initially issued token as part of 'juju show-user' output if you are a controller admin.

Controller admin will run 'juju show-user --registration' to view this value.
If anyone else will use this option, we'll err them out.
If user has already logged on at least once, we'll let controller admin know and will not display registration key.

Does the option '--registration' make sense or do you have another word in mind that you would like me to use?